Reported CDICC Data Breach: 671 Records With Emails and Hashes

HEROIC analysts logged a reported data breach under the name CDICC, dated August 1, 2023. The record claims 671 entries, each holding an email address and a password hash. The claim has not been confirmed, so scanning your email is the only way to learn whether your own information is in it.

What a Hash Does and Does Not Protect

A password hash is a scrambled form of a password. It is harder to use than a plain password, but it can be attacked, especially when the original password was short or easy to guess. For the 671 records reported here, the safe assumption is that any password reused elsewhere deserves a replacement.

The Two Data Types Reported

• Email addresses: the identifier tied to each record, and an address phishing messages can reach.
• Password hashes: scrambled passwords, reported without any plain text.

Why These 671 Records Need a Look

Records like these can be matched against logins from other sources. A reused password is how a reported leak at one site turns into access to a mailbox or a work login, and mailbox control opens the door to resets elsewhere. Takeover of a login and fraud begin with that single link. With 671 records reported, the list can include the address you rely on.

How a Database Breach Works

A database breach is a copy of records taken from one service's own systems. Because the claim here is reported and unconfirmed, the details could change, and the record itself says nothing beyond the name, the date, the count and the two data types. HEROIC makes no statement about what CDICC is or does.

Is Your Address in the Reported 671?

To check, scan your email and see your information. If your address appears, change the password at CDICC and anywhere you used the same one, then watch for emails that pretend to come from CDICC. Work and personal addresses are both worth a scan.